CVE-2026-14516 in Bookly Plugin
Summary
by MITRE • 07/28/2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a two-request chain: an attacker first calls the unauthenticated bookly_get_form_id action to seed a booking session carrying malicious staff_ids values, then triggers bookly_render_time to cause the tainted array to reach the vulnerable query; CSRF/nonce validation is absent on both endpoints, meaning this chain can be initiated cross-site.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in the Bookly plugin for WordPress represents a critical time-based sql injection flaw that affects versions up to and including 27.5. This security weakness stems from inadequate input sanitization and improper query preparation mechanisms within the plugin's codebase. The specific vector involves the 'staff_ids' parameter which fails to properly escape user-supplied data before incorporating it into database queries. This vulnerability classification aligns with CWE-89 which details improper neutralization of special elements used in SQL commands, creating an environment where malicious actors can manipulate database operations through crafted input parameters.
The exploitation mechanism requires a sophisticated two-request chain that demonstrates the complexity of the attack vector while maintaining its practical threat level. The initial request leverages the unauthenticated bookly_get_form_id action to establish a booking session context, effectively seeding the malicious staff_ids values into the system's temporary storage. Subsequently, the attacker triggers the bookly_render_time endpoint which processes the tainted array through the vulnerable sql query path. This sequential approach highlights how modern web applications can be compromised through carefully orchestrated multi-step attacks that bypass traditional single-point defenses.
The absence of csrf and nonce validation across both vulnerable endpoints significantly amplifies the threat surface and makes this vulnerability particularly dangerous for cross-site exploitation. Without proper session validation mechanisms, attackers can initiate the malicious request chain from external domains, enabling them to exploit the vulnerability without requiring authentication or direct access to the target system. This characteristic places the vulnerability in the ATT&CK framework under technique T1213.002 which covers data from local system databases, and demonstrates how insufficient access controls can compound existing code vulnerabilities into remotely exploitable threats.
The operational impact of this vulnerability extends beyond simple data exfiltration to potentially compromise the entire WordPress installation and underlying database infrastructure. Attackers can leverage time-based sql injection techniques to extract sensitive information including user credentials, personal data, and administrative access details through carefully constructed queries that manipulate response times for boolean-based inference. The lack of proper input validation creates a persistent threat vector that remains active throughout the plugin's lifecycle, making it particularly dangerous for long-running systems where patching may be delayed or incomplete.
Mitigation strategies should focus on immediate code-level fixes including implementing proper parameter binding and input sanitization for all user-supplied parameters. The plugin developers must enforce strict input validation routines that prevent malicious data from reaching database queries while also implementing comprehensive csrf protection mechanisms across all endpoints. Additionally, organizations should consider implementing network-based intrusion detection systems to monitor for suspicious patterns in api endpoint access and establish regular security auditing procedures to identify similar vulnerabilities in other plugins or custom code components. The vulnerability serves as a prime example of why input validation and proper sql query preparation should be fundamental security practices throughout application development lifecycle processes.